The Advanced Post Block WordPress plugin suffers from a missing capability check in its apbPosts() AJAX handler function. This missing authorization allows unauthenticated users to retrieve all post data, including password-protected content, from affected plugin versions up to 1.13.4. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 score of 5.3 indicates a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or official fix has been documented in the provided data.

An attacker without authentication can access all post data managed by the plugin, including posts that are password protected. This leads to a confidentiality breach of potentially sensitive content. There is no impact on integrity or availability reported. No known active exploitation has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the plugin or restricting access to AJAX endpoints related to the plugin to trusted users only. Monitor for vendor updates and apply patches promptly once available.